CVEs published April 7, 2023
98 CVEs were published on April 7, 2023: 29 critical, 20 high.
- Published
- 98
- Critical
- 29
- High
- 20
- Medium
- 46
- Low
- 1
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Kiboko Labs Arigato Autoresponder and Newsletter
- 3
- Cimatti Consulting WordPress Contact Forms by Cimatti
- 2
- Fullworks Quick Paypal Payments
- 2
- GitHub Enterprise Server
- 2
- IBM Sterling Order Management
- 2
- IBM TRIRIGA Application Platform
- 2
- SourceCodester Simple and Beautiful Shopping Cart System
- 2
- Apache Software Foundation Apache Airflow Drill Provider… +1
- 1
- Apache Software Foundation Apache Airflow Hive Provider · a…
- 1
- Apache Software Foundation Apache Airflow Spark Provider ·…
- 1
Critical 29
- CVE-2023-28706Apache Airflow Hive Provider Beeline Remote Command ExecutionApache Software Foundation Apache Airflow Hive Provider · a…
- CVE-2023-24797D-Link DIR882 DIR882A1_FW110B02 was discovered to contain a stack overflow in the sub_48AC20 function.
- CVE-2023-24798D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_475FB0 function.
- CVE-2023-24799D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_48AF78 function.
- CVE-2023-24800D-Link DIR878 DIR_878_FW120B05 was discovered to contain a stack overflow in the sub_495220 function.
- CVE-2023-25210Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetSysTime function.
- CVE-2023-25211Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the R7WebsSecurityHandler function.
- CVE-2023-25212Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromSetWirelessRepeat function.
- CVE-2023-25213Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the check_param_changed function.
- CVE-2023-25214Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the setSchedWifi function.
- CVE-2023-25215Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the saveParentControlInfo function.
- CVE-2023-25216Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formSetFirewallCfg function.
- CVE-2023-25217Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the formWifiBasicSet function.
- CVE-2023-25218Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the form_fast_setting_wifi_set function.
- CVE-2023-25219Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the fromDhcpListClient function.
- CVE-2023-25220Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 was discovered to contain a stack overflow via the add_white_node function.
- CVE-2023-26848TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the org parameter at setting/delStat
- CVE-2023-26978TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pppoeAcName parameter at /setting
- CVE-2023-27012Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the setSchedWifi function.
- CVE-2023-27013Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the get_parentControl_list_Info function.
- CVE-2023-27014Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_46AC38 function.
- CVE-2023-27015Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_4A75C0 function.
- CVE-2023-27016Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the R7WebsSecurityHandler function.
- CVE-2023-27018Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_45EC1C function.
- CVE-2023-27019Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_458FBC function.
- CVE-2023-27020Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the saveParentControlInfo function.
- CVE-2023-27021Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the formSetFirewallCfg function.
- CVE-2023-27033Prestashop cdesigner v3.1.3 to v3.1.8 was discovered to contain a code injection vulnerability via the component CdesignerSaverotateModuleFr
- CVE-2023-29478BiblioCraft before 2.4.6 does not sanitize path-traversal characters in filenames, allowing restricted write access to almost anywhere on th
High 20
- CVE-2023-23761Improper authentication vulnerability in GitHub Enterprise Server leading to modification of secret gistsGitHub Enterprise Server
- CVE-2023-1941SourceCodester Simple and Beautiful Shopping Cart System login.php sql injectionSourceCodester Simple and Beautiful Shopping Cart System
- CVE-2023-28710Apache Airflow Spark Provider Arbitrary File Read via JDBCApache Software Foundation Apache Airflow Spark Provider ·…
- CVE-2023-28707Airflow Apache Drill Provider Arbitrary File Read VulnerabilityApache Software Foundation Apache Airflow Drill Provider… +1
- CVE-2023-29388WordPress Product Catalog Simple Plugin <= 1.6.17 is vulnerable to Cross Site Scripting (XSS)impleCode Product Catalog Simple
- CVE-2023-29171WordPress Magic Post Thumbnail Plugin <= 4.1.10 is vulnerable to Cross Site Scripting (XSS)Magic Post Thumbnail
- CVE-2023-29172WordPress PropertyHive Plugin <= 1.5.46 is vulnerable to Cross Site Scripting (XSS)PropertyHive
- CVE-2023-28789WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)Cimatti Consulting WordPress Contact Forms by Cimatti
- CVE-2023-28781WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)Cimatti Consulting WordPress Contact Forms by Cimatti
- CVE-2023-28792WordPress Continuous Image Carousel With Lightbox Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Continuous Image Carousel With Ligh…
- CVE-2023-27876IBM TRIRIGA Application Platform XML external entity injectionIBM TRIRIGA Application Platform
- CVE-2023-25713WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Paypal Payments
- CVE-2023-28993WordPress Albo Pretorio Online Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)Ignazio Scimone Albo Pretorio On line
- CVE-2023-29236WordPress Outdoor Theme <= 3.9.6 is vulnerable to Cross Site Scripting (XSS)Cththemes Outdoor
- CVE-2023-25041WordPress Monolit Theme <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)Cththemes Monolit
- CVE-2023-25020WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)Kiboko Labs Arigato Autoresponder and Newsletter
- CVE-2023-28051 Dell Power Manager, versions 3.10 and prior, contains an Improper Access Control vulnerability.Dell Power Manager
- CVE-2023-26817codefever before 2023.2.7-commit-b1c2e7f was discovered to contain a remote code execution (RCE) vulnerability via the component /controller
- CVE-2023-26820siteproxy v1.0 was discovered to contain a path traversal vulnerability via the component index.js.
- CVE-2023-27180GDidees CMS v3.9.1 was discovered to contain a source code disclosure vulnerability by the backup feature which is accessible via /_admin/ba
Medium, low and unrated 49
- CVE-2023-1947taoCMS admin.php code injectiontaoCMS
- CVE-2023-1946SourceCodester Survey Application System Add New cross site scriptingSourceCodester Survey Application System
- CVE-2023-1801The SMB protocol decoder in tcpdump version 4.99.3 can perform an out-of-bounds write when decoding a crafted network packet.The Tcpdump Group tcpdump
- CVE-2023-23762Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingGitHub Enterprise Server
- CVE-2023-1942SourceCodester Online Computer and Laptop Store Avatar unrestricted uploadSourceCodester Online Computer and Laptop Store
- CVE-2023-1940SourceCodester Simple and Beautiful Shopping Cart System delete_user_query.php sql injectionSourceCodester Simple and Beautiful Shopping Cart System
- CVE-2023-1909PHPGurukul BP Monitoring Management System User Profile Update profile.php sql injectionPHPGurukul BP Monitoring Management System
- CVE-2023-29170WordPress Product Enquiry for WooCommerce Plugin <= 2.2.12 is vulnerable to Cross Site Scripting (XSS)PI Websolution Product Enquiry for WooCommerce, WooCommerce…
- CVE-2023-27620WordPress Robo Gallery Plugin <= 3.2.12 is vulnerable to Cross Site Scripting (XSS)RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery
- CVE-2023-25442WordPress Zeno Font Resizer Plugin <= 1.7.9 is vulnerable to Cross Site Scripting (XSS)Marcel Pol Zeno Font Resizer
- CVE-2023-23799WordPress Easy Panorama Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)Leonardo Giacone Easy Panorama
- CVE-2022-43928IBM Db2 Mirror for i information disclosureIBM Db2 Mirror for i
- CVE-2022-43914IBM TRIRIGA Application Platform cross-site scriptingIBM TRIRIGA Application Platform
- CVE-2022-33959IBM Sterling Order Management privilege escalationIBM Sterling Order Management
- CVE-2023-29094WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.20 is vulnerable to Cross Site Scripting (XSS)PI Websolution Product page shipping calculator for WooComm…
- CVE-2022-34333IBM Sterling Order Management information disclosureIBM Sterling Order Management
- CVE-2023-25702WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Paypal Payments
- CVE-2023-25705WordPress WP Prayer Plugin <= 1.9.6 is vulnerable to Cross Site Scripting (XSS)Go Prayer WP Prayer
- CVE-2023-25712WordPress Opt-Out for Google Analytics Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)WP-Buddy Google Analytics Opt-Out
- CVE-2023-25711WordPress WPGlobus Translate Options Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)WPGlobus Translate Options
- CVE-2023-1726XSS in Proliz OBSProliz OBS
- CVE-2023-25464WordPress Twitch Player Plugin <= 2.1.0 is vulnerable to Cross Site Scripting (XSS)StreamWeasels Twitch Player
- CVE-2023-25716WordPress Announce from the Dashboard Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)gqevu6bsiz Announce from the Dashboard
- CVE-2023-23994WordPress Auto Hide Admin Bar Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Marcel Bootsman Auto Hide Admin Bar
- CVE-2023-23885WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Contact Form
- CVE-2023-25049WordPress eCommerce Product Catalog Plugin <= 3.3.4 is vulnerable to Cross Site Scripting (XSS)impleCode eCommerce Product Catalog Plugin for WordPress
- CVE-2023-25031WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)Kiboko Labs Arigato Autoresponder and Newsletter
- CVE-2023-25024WordPress Icegram Collect plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)Icegram Collect
- CVE-2023-25027WordPress Chained Quiz Plugin <= 1.3.2.5 is vulnerable to Cross Site Scripting (XSS)Kiboko Labs Chained Quiz
- CVE-2023-25022WordPress Watu Quiz Plugin <= 3.3.8 is vulnerable to Cross Site Scripting (XSS)Kiboko Labs Watu Quiz
- CVE-2023-25023WordPress WebinarIgnition Plugin <= 2.14.2 is vulnerable to Cross Site Scripting (XSS)Saleswonder.biz Webinar ignition
- CVE-2023-25046WordPress Podlove Podcast Publisher Plugin <= 3.8.2 is vulnerable to Cross Site Scripting (XSS)Podlove Podcast Publisher
- CVE-2023-24398WordPress EZP Coming Soon Page Plugin <= 1.0.7.3 is vulnerable to Cross Site Scripting (XSS)Snap Creek Software EZP Coming Soon Page
- CVE-2023-24402WordPress WP Booking System Plugin <= 2.0.18 is vulnerable to Cross Site Scripting (XSS)Veribo, Roland Murg WP Booking System – Booking Calendar
- CVE-2023-25059WordPress avalex Plugin <= 3.0.3 is vulnerable to Cross Site Scripting (XSS)avalex – Automatically secure legal texts
- CVE-2023-25061WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.1.1 is vulnerable to Cross Site Scripting (XSS)Kiboko Labs Arigato Autoresponder and Newsletter
- CVE-2023-1937zhenfeng13 My-Blog userInfo cross-site request forgeryzhenfeng13 My-Blog
- CVE-2020-11935aufs: improperly managed inode reference counts in the vfsub_dentry_open() methodUbuntu Linux kernel
- CVE-2022-43309Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.
- CVE-2023-27017Tenda AC10 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the sub_45DC58 function.
- CVE-2023-27801H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
- CVE-2023-27802H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditvsList parameter at /goform/aspForm.
- CVE-2023-27803H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
- CVE-2023-27804H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
- CVE-2023-27805H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm.
- CVE-2023-27806H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_dellist interface at /goform/aspForm.
- CVE-2023-27807H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm.
- CVE-2023-27808H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
- CVE-2023-27810H3C Magic R100 R100V100R005.bin was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.